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DEVICE FOR MONITORING THE INTEGRITY OF INFORMATION 
DELIVERED BY A HYBRID INS/GNSS SYSTEM 

CROSS - REFERENCE TO RELATED AP PLICATIONS 

The present Application is based on Internati onal Application No. 
PCT/EP2005/050390. filed on January 31 - 2005 and p riority is hereby claimed under 
35 USC §119 based on this application. 



BACKGROUND OF THE INVENTION 



FIFI D OF THE INVENTION 

15 

The invention relates to the monitoring of the integrity of position 
and speed information obtained from a hybridization between an inertial unit 
and a satellite positioning receiver. It more specifically relates to a navigation 
device known in the art by the name of INS/GNSS (standing for "Inertial 
20 Navigation System" and "Global Navigation Satellite System") that is 
hybridized in closed loop mode, the hybridization being said to be loose 
because it is implemented on geographic lines. 

DESCRIPTION OF THE RELATED ART 

25 

An inertial unit is made up of a set of inertial sensors (gyrometric 
sensors and accelerometric sensors) associated with electronic processing 
circuitry. A computation platform, called virtual platform PFV, then delivers 
the speed and position information of the bearer in a precise frame of 

30 reference (denoted LGT, or local geographic trihedron). The virtual platform 
PFV is used to project and integrate the data obtained from the inertial 
sensors. The inertial unit supplies information that is accurate in the short 
term but tends to drift in the long term (under the influence of sensor defects). 
Control of the sensor defects represents a very high proportion of the cost of 

35 the inertial unit. 



2 



A satellite positioning receiver supplies position and speed 
information concerning the bearer by triangulation based on the positions of 
orbiting satellites visible to the bearer. The information supplied can be 
temporarily unavailable because the receiver needs to have in direct view a 

5 minimum of four satellites of the positioning system to be able to establish a 
point. It is also of variable accuracy, dependent on the geometry of the 
constellation on which the triangulation is based, and affected by noise 
because of the reliance on the reception of very weak signals originating from 
distant satellites having a low transmit power. However, they are not subject 

10 to drift in the long term, the positions of the orbiting satellites being known 
accurately in the long term. The noises and errors can be linked to the 
satellite systems, to the receiver or to the propagation of the signal between 
the satellite transmitter and the GNSS signal receiver. Furthermore, the 
satellite data may be erroneous as a consequence of failures affecting the 

15 satellites. This non-integrated data must then be identified to prevent it from 
falsifying the position obtained from the GNSS receiver. 

To anticipate the satellite failures and ensure the integrity of the 
GNSS measurements, a known method is to equip a satellite positioning 
receiver with a so-called RAIM (Receiver Autonomous Integrity Monitoring) 

20 system (an accuracy and availability estimation system) which is based on 
the geometry of the satellite constellation used in the triangulation and on the 
predictable short-term trend of this geometry deduced from the knowledge of 
the trajectories of the satellites. However, this system, purely linked to the 
satellite location system, is not applicable to the monitoring of a location point 

25 derived from a hybrid system (INS/GNSS) and can detect only certain types 
of failures in a given time. 

The hybridization consists in mathematically combining the 
position and speed information supplied by the inertial unit and the satellite 
positioning receiver to obtain position and speed information by exploiting 

30 both systems. Thus, the accuracy of the positioning information supplied by 
the GNSS system can be used to control the inertial drift and the inertial 
measurements that are little affected by noise can be used to filter the noise 
on the measurements of the GNSS receiver. This combination very often 
makes use of the Kalman filtering technique. 
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Kalman filtering is based on the possibilities of modeling the trend 
(or evolution) of the state of a physical system considered in its environment, 
by means of a so-called "evolution" equation (a priori estimation), and of 
modeling the dependency relationship existing between the states of the 

5 physical system concerned and the measurements by which it is perceived 
from outside, by means of a so-called "observation" equation to allow for a 
readjustment of the states of the filter (a posteriori estimation). In a Kalman 
filter, the actual measurement or "measurement vector" is used to produce 
an a posteriori estimate of the state of the system which is optimal in the 

10 sense that it minimizes the covariance of the error made on this estimation. 
The estimator part of the filter generates a priori estimates of the state vector 
of the system using the deviation observed between the actual measurement 
vector and its a priori prediction to generate a corrective term, called 
innovation. This innovation is applied to the a posteriori estimate of the state 

15 vector of the system and results in the optimal a posteriori estimate being 
obtained. 

In the case of a hybrid INS/GNSS system, the Kalman filter 
receives the position and speed points supplied by the inertial unit and the 
satellite positioning receiver, models the trend of the errors of the inertial unit 
20 and delivers the a posteriori estimate of these errors which is used to correct 
the positioning and speed point of the inertial unit. 

The estimation of the position and speed errors due to the defects 
of the inertial sensors appearing at the output of the virtual platform PFV of 
the inertial unit is produced by the Kalman filter. The correction of the errors 
25 through the intermediary of their estimation done by the Kalman filter can 
then be done at the input of the virtual platform PFV (closed loop 
architecture) or at the output (open loop architecture). 

When the defects of the sensors of the inertial unit are not too 
great, there is no need to apply the corrections at the input of the virtual 
30 platform PFV. The modeling of the system (linearization of the equations 
governing the evolution of the system) within the filter remains valid. The a 
posteriori estimate of the errors of the inertial unit calculated in the Kalman 
filter is used only to create the best estimate of the position and speed of the 
bearer given the position and speed information supplied by the inertial unit 
35 and by the GNSS receiver. The hybridization is then said to be "open loop". 
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When the inertial defects are too great, the linearization of the 
equations governing the evolution of the inertial model integrated within the 
Kalman filter is no longer valid. It is therefore essential to apply the 
corrections to the virtual platform PFV to remain within the linear domain. The 
5 a posteriori estimate of the errors the inertial unit calculated in the Kalman 
filter is used not only to create the best estimate of the position and speed of 
the bearer, but also to readjust the inertial unit within the virtual platform PFV. 
The hybridization is then said to be "closed loop". 

The hybridization can also be done by observing GNSS 
10 information of different types. Either, the position and speed of the bearer 
resolved by the GNSS receiver can be considered, in which case the 
hybridization is said to be "loose", or the information extracted upstream by 
the GNSS receiver - the pseudo-distances and pseudo-speeds (quantities 
directly derived from the measurement of the propagation time and from the 
15 Doppler effect of the signals sent by the satellites to the receiver) - can be 
considered, in which case the hybridization is said to be "tight". 

With a closed loop INS/GNSS system in which the point resolved 
by the GNSS receiver is used to readjust the information originating from the 
inertial unit, it is necessary to pay particular attention to the defects affecting 
20 the information supplied by the satellites, because the receiver that receives 
the information will propagate these defects to the inertial unit, resulting in an 
incorrect readjustment of the latter. The problem becomes particularly critical 
when it comes to ensuring the integrity of a hybrid INS/GPS point. 

A known way of proceeding to monitor the integrity of an 
25 INS/GNSS hybrid system in closed loop mode is disclosed in US patent 
5,583,774. It consists in spacing the readjustments by a time that is long 
enough (for example 30 minutes) for a Kalman-filter-based detector 
monitoring the trend of the pseudo-distance and pseudo-speed measurement 
deviations, relative to the bearer of each visible satellite, to be able to isolate 
30 the malfunctioning satellites. 

Another known method for monitoring the integrity of an 
INS/GNSS hybrid system is disclosed in US patent 5,923,286. It involves the 
use of an RAIM device to enable or disable the hybridization. When the RAIM 
device signals a loss of integrity, the hybridization is frozen and the position 
35 and speed point is supplied by the INS unit taking into account its drifts and 
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bias measured just before the loss of integrity. For this to work, it is essential 
for the inertial unit not to have been corrupted by the point error committed by 
the GNSS receiver, which prohibits that being readjusted with the GNSS 
receiver. The method is therefore reserved only for the open loop INS/GNSS 
5 hybrid systems. 

Sj IMMMARY OF THE INVENTION 

It is an object of the present invention to monitor the integrity of the 
10 position and speed information of a hybrid system comprising an inertial unit 
readjusted with the help of a GNSS receiver by using the resolved position 
and speed of the bearer obtained from the GNSS receiver. 

Briefly stated, the present invention is directed to a device for 
monitoring the integrity of a hybrid system comprising an inertial unit INS, a 
15 GNSS satellite positioning receiver operating on the basis of a constellation 
of N visible satellites and a Kalman hybridization filter having a state vector 
corresponding to the errors of the hybrid system, in particular, the bias and 
residual drift errors of the inertial unit INS, observing the deviations between 
the positioning and speed points supplied, in the form of geographic 
20 coordinates, by the inertial unit INS and by the GNSS receiver, having an 
evolution matrix F modeling the trend of the errors of the hybrid system, an 
observation matrix H modeling the relationships between the state vector and 
the deviations observed between the positions and the speeds delivered by 
the inertial unit INS and the GNSS receiver, and a gain K minimizing the 
25 covariance of the error made on the a posteriori estimation of the position 
and speed errors derived from the inertial unit, and delivering an a posteriori 
estimate of the errors of the hybrid system used to readjust the inertial unit. 
This monitoring system is noteworthy in that the GNSS receiver delivers, in 
addition to a position point established from the N satellites of the 
30 constellation that is has in view, N-1 position points established from the 
constellation of the N visible satellites deprived, each time, of a different 
satellite and in that it comprises a satellite problem-detector circuit 
comprising a bank of N predictor/estimator filters of the error induced by the 
satellite that was removed on resolving a point with N-1 satellites, having the 
35 gain K and the evolution matrix F of the Kalman hybridization filter, each filter 
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observing the deviation between the position point, in the form of geographic 
coordinates, delivered by the GNSS receiver by observing the N visible 
satellites and one of the position points, also in the form of geographic 
coordinates, delivered by the GNSS receiver by observing N-1 visible 
5 satellites and test circuits comparing the states of the N predictor/estimator 
filters with their variances and detecting a satellite failure when the test is 
positive, the deviation found being greater than a detection threshold. 

Advantageously, the test circuits have satellite-failure detection 
10 thresholds that result from statistical tests taking account of the covariance 
associated with the type of positioning error concerned. 

Advantageously, the test circuits have satellite-failure detection 
thresholds that result from statistical tests taking account of the covariance 
15 associated with the type of positioning error concerned and that are a 
function of the acceptable false alarm ratio for the test. 

Advantageously, the monitoring system comprises a readjustment 
inhibition circuit inserted between the output of the Kalman hybridization filter 
20 and a readjustment input of the inertial unit, and activated by a positive 
satellite problem-detection test. 

Advantageously, the predictor/estimator filters of the satellite 
problem-detector circuit (first filter bank) all have the same observation 
25 matrix. 

Advantageously, the GNSS receiver also delivers position points, 
in the form of geographic coordinates, established from the N visible 
satellites and those established from N-1 satellites deducted from the 

30 constellation formed by the N visible satellites by each time removing a 
different visible satellite, Nx(N-1)/2 position points with N-2 satellites 
deducted from the N visible satellites by each time removing two different 
visible satellites, and the monitoring system comprises a malfunctioning- 
satellite identification circuit comprising a second bank of Nx(N-1)/2 

35 positioning deviation predictor/estimator filters having the gain K and the 



evolution matrix F of the Kalman hybridization filter, each filter observing the 
deviation between a position point, in the form of geographic coordinates, 
delivered by the GNSS receiver from N-1 satellites out of the N visible 
satellites and one of the positioning points delivered by the satellite 

5 positioning receiver from N-2 satellites out of the N visible satellites deducted 
from the specific constellation of (N-1) visible satellites deprived of one of its 
visible satellites, the estimator-detector filters being able to be grouped in 
families of N-2 elements according to the specific constellation of N-1 visible 
satellites taken into account, test circuits comparing the states of the 

10 Nx(N-1)/2 predictor/estimator filters with their variances in order to detect any 
anomaly and a processing circuit identifying, if anomalies are detected, a 
faulty satellite as being the satellite excluded from a point with n-1 satellites 
for which the family of predictor/estimator filters is the only one not to have 
any of its elements detecting an anomaly. 

15 

Advantageously, the predictor/estimator filters of the 
malfunctioning-satellite identification circuit all have the same observation 
matrix. 

20 Advantageously, the predictor/estimator filters of the satellite 

problem-detector and of the malfunctioning-satellite identification circuit all 
have the same observation matrix. 

BRIEF DESCRIPTION OF THE DRAWINGS 

25 

Other characteristics and advantages of the invention will become 
apparent from the description that follows of an embodiment given by way of 
example. This description is given in light of the drawing in which; 

- figures 1 and 2 represent a theoretical diagram of a closed loop, 
30 loose type hybrid INS/GNSS positioning system, figure 1 

detailing the inertial unit and figure 2 the Kalman filter, 

- figure 3 represents a hybrid INS/GNSS positioning system 

provided with a satellite problem-detector circuit compliant with 
the invention, 
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- figure 4 represents a hybrid INS/GNSS positioning system 

provided with a satellite problem-detector circuit and a faulty- 
satellite identification circuit compliant with the invention, and 

- figure 5 details the constitution of the faulty-satellite identification 
5 circuit of figure 4. 

DETAILED DESCRIPTION OF THE EMBODIMENTS 

Figure 1 shows the architecture of a hybrid positioning system 

10 equipped with an inertial unit 1 and a GNSS satellite positioning receiver 2, 
said to be in closed loop mode and of loose type, because it uses resolved 
position (latitude, longitude and altitude) and speed (speed north, speed east 
and speed vertical) information concerning the bearer delivered by the GNSS 
receiver 2 for readjusting of the inertial unit INS 1 . 

15 As shown, the inertial unit comprises a set 10 of inertial sensors 

(accelerometers and gyrometers) and computation circuits, called virtual 
platform PFV, to perform the position, attitude and speed computations on 
the outputs of the inertial sensors. The virtual platform PFV mainly comprises 
a set of integrators 1 1 operating on the signals O of the gyrometers in order 

20 to deduce from them the attitude of the bearer, a fix changer 12 used, based 
on the knowledge of the orientation of the bearer (attitude), to express within 
a geographic fix linked to the Earth, the accelerations acc measured by the 
accelerometers within a fix linked to the bearer and two successive integrator 
sets 13, 14 operating on the components of the acceleration according to the 

25 geographic fix, to deduce from them the components of the speed of the 
bearer relative to the north Vn, relative to the east Ve and relative to the 
vertical Vv as well as the position of the bearer in latitude, longitude and 
altitude. The inertial sensors are subject to defects inherent in their design: 
biases and drifts that make the position and attitude information delivered by 

30 an inertial unit degrade over operating time. Trying to overcome these 
defects is costly, so there are various classes of inertial unit according to 
accepted bias and drift tolerances. 

The GNSS receiver 2 is, for example, a GPS receiver. It measures 
the pseudo-distances and pseudo-speeds of the bearer relative to at least 

35 four satellites visible to the bearer of the hybrid positioning system and 
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resolves, by triangulation, the position of the bearer in latitude, longitude and 
altitude, as well as the components of its speed relative to the north Vn, 
relative to the east Ve and relative to the vertical Vv. It will not be described 
in more detail because it is well known to those skilled in the art and widely 

5 described in the literature in which numerous works are devoted to it, such 
as, for example the book by Elliot D. KAPLAN entitled "Understanding GPS 
Principles and Applications", published by Artech House Publishers, ISBN 0- 
89006-793-7. The position and speed information delivered by a GNSS 
receiver is not subject to drift since it originates from instantaneous 

10 measurements of separation distances and speeds of separation of satellites 
for which the orbits and the positions in their orbits are known in the long 
term. However, it is subject to unavailability, when there are not at least four 
satellites visible. It is affected by noise because it originates from the 
processing of received signals that are very weak because of the distance 

15 separating the satellites and their weak transmit powers and that may have 
been corrupted during transmission (encountering charged particles between 
the satellite and the receiver). The reliability of the information depends on 
that of the information transmitted by the satellites. 

Compared to the GNSS receiver, the inertial unit has the 

20 advantage of not requiring the collaboration of equipment external to the 
bearer and therefore of not being so sensitive to the external environment. 
Since the integrity and availability of the inertial information is much better, 
the inertial unit retains all its interest. To fight against its drift and bias other 
than by costly measurements taken on its inertial sensors, a periodic 

25 readjustment is proposed by means of the position and speed point supplied 
by a GNSS receiver, after an anti-noise filtering. 

This readjustment is done using a so-called Kalman hybridization 
filter 3 shown in greater detail in figure 2. 

A Kalman filter is used to obtain an estimation of the a posteriori 

30 state of a system, optimal in the sense that the covariance of the error made 
on this a posteriori estimation is minimal (also referred to as optimal 
estimation in the least squares sense). It is based on a modeling of the 
evolution of the system and on a modeling of the relationship existing 
between the measurement and the state of the system. 
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In its most general meaning, the modeling of the evolution of the 
state of the system is defined by a first order, linearized vectorial differential 
equation which is expressed, after discretization of the continuous model, by 

an evolution equation which takes the form: 

x KM =F K x K +L K u, + w K 

x being the dimension state vector p, u a control vector, F K the evolution 
matrix defining the relationship between the state vector in the step K and the 
state vector in the step K+1 in the absence of control vector and operating 
noise, U being a matrix defining the relationship between the control vector 
and the state vector during one and the same step and w K being an operating 
noise during a step, assumed to be white and Gaussian of zero average 
value. 

The modeling of the relationship existing between the 
measurement and the state of the system is defined by another first order 
differential equation that expresses, after discretization of the continuous 
model, by an observation equation that takes the form: 

z K = H K x K + v K 

z being the dimension measurement vector m (physically observable 
system quantities), H K being the observation matrix defining the relationship 
between the measurement vector and the state vector during one and the 
same step and v K being a measurement noise during a step assumed to be 
white and Gaussian of zero average value. 

The Kalman filter shown in figure 2 does not include a control 
vector and therefore has no matrix L K . It is recursive and relies on the 
determination of an a priori estimation x KIK . x of the state vector of the system 
in the step K from the a posteriori knowledge of the state vector of the system 
Xic vK i in the preceding step K-1 and on the application to the a priori 
estimate i MH of a correcting term dependent on the deviation observed 
between the measurement vector z K observed during this step K and its a 
priori estimate z KIKA deducted from the a priori estimation x KIK . x of the state 
vector. 

The a priori estimate z KIKA of the measurement vector in the step 
K is determined by application of evolution and observation equations to the 
a posteriori estimate x K _ XIK . x of the state vector corresponding to the 
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preceding step K-1 . This operation is illustrated in figure 2 by the presence of 
a retroaction loop comprising a delay circuit 30 and two filters 31, 32. 

The delay circuit 30 connected to the output of the Kalman filter is 
used to store the a posteriori estimate of the state vector available at 

the output of the Kalman filter during the preceding step K-1 . 

The filter 31 is used, by implementing the evolution equation, to 
obtain the a priori estimate x KIK _ x of the state vector in the step K, from the a 
posteriori estimate x K _ VK . x of the state vector of the system in the preceding 
step K-1. Its transfer function is defined by the matrix F K . X of the evolution 
equation. 

This a priori estimate x KIK . x of the state vector in the step K is then 
used to obtain, by means of a second filter 32, the a priori estimate z KIK . x of 
the measurement vector in the step K by application of the observation 
equation. To do this, this second filter 32 has a transfer function defined by 
the matrix H K of the observation equation. 

The a priori estimate z KIKA of the measurement vector in the step 
K obtained in the retroaction loop is applied, as input to the Kalman filter, to a 
subtractor circuit 33 which also receives the measurement vector z K actually 
measured during the step K and which delivers an error vector r K , also called 
innovation, attesting to the error committed in the a priori estimation. This 
error vector r K is transformed by a third filter 34 into a correction vector. This 
correction vector is added by a second summer 35 to the a priori estimate 
x KIK . x of the state vector for the step K derived from the first filter 31, to 
obtain the a posteriori estimate x KIK of the state vector that constitutes the 
output of the Kalman filter. 

The third filter 34, which supplies the corrective term, is known as 
a readjustment gain filter. It has a transfer function defined by a matrix K K 
determined so as to minimize the covariance of the error made on the a 
posteriori estimation. 

Kalman showed that the optimal gain matrix K K could be 
determined by a recursive method from the equations: 

- of the covariance matrix of the a priori estimate of the state 
vector 

P/CIK-l ~ ^K-\^K-\IK-\^K-\ + Qk-\ 

- for defining the gain matrix itself 
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- for updating the covariance matrix of the a posteriori estimate of 
the state vector 

5 P being the covariance matrix of the state vector, either estimated a priori for 
the step K from the step K-1 if P is assigned the index K/K-1, or estimated a 
posteriori if P is assigned the index K-1/K-1, 
R being the covariance matrix of the observation noises w K , 
Q being the covariance matrix of the state noises (or operating noises) . 

10 On initialization, the covariance matrix of the state vector and the 

state vector are taken to be equal to their most probable estimates. At worst, 
the covariance matrix is a diagonal matrix with infinite or extremely large 
terms (so as to have very great standard deviations given the field in which 
the state vector is likely to evolve) and the estimate of the state vector is the 

15 zero vector, when the initial values are absolutely unknown. 

In practice, the correction gain of a Kalman filter is "proportional" 
to the uncertainty on the a priori estimate of the state of the system and 
"inversely proportional" to the uncertainty on the measurement. If the 
measurement is highly uncertain and the estimation of the state of the 

20 system is relatively accurate, the observed deviation is mainly due to the 
measurement noise and the consequential correction must be small. On the 
other hand, if the uncertainty on the measurement is low and that on the 
estimation of the state of the system is high, the observed deviation is highly 
representative of the estimation error and should result in a big correction. 

25 This is the behavior towards which there is a tendency with the Kalman filter. 

In summary, a Kalman filter with no control vector is defined by a 
matrix F K corresponding to the evolution equation defining the evolution of 
the state vector of the physical system being modeled, a matrix H K 
corresponding to the observation equation defining the relationships used to 

30 pass from the state vector to the measurement vector and a gain matrix K K 
updated using an iterative process involving the covariance matrix of the 
state vector P, itself updated during the iterative process, and the covariance 
matrices Q K and R K of the state and measurement noises. 

The Kalman filter 3 operates on the deviations observed between 

35 two versions of information of the same type, one originating from the inertial 
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unit INS 1 and the other from the GNSS receiver 2, because this makes it 
possible to work on variables having more restricted variation ranges on 
which the linear approximation can be used to simplify the modeling and 
evolution equations (the term "error filter" is then used). 

5 In this context, the evolution equation of the Kalman filter models 

the predictable trend of the errors on the hybrid system linked to the residual 
values of the inertial sensor defects not estimated and to the mechanization 
of the inertial platform (in this case closed loop) of the inertial unit 1 that it 
deduces from the differences observed between the deviation forecast that it 

10 makes and the deviations actually measured between the position and the 
speed derived from the inertial unit and from the GNSS receiver. It is 
determined by the matrix F, the definition of which is a function of the motion 
of the bearer, that is, of the flight parameters in the case where the bearer 
equipped with the hybrid positioning system is an aircraft. The definition of 

15 the different versions of this matrix F as a function of the motion parameters 
of the bearer falls outside the scope of the present invention. It will not be 
detailed below because it is well known to those skilled in the art specializing 
in the field of inertia. 

The residual values x KIK of the errors of the hybrid system 

20 estimated a posteriori by the Kalman hybridization filter 3 are used to readjust 
the INS inertial unit 1 (closed loop). Since the INS 1 inertial information is 
regularly readjusted, the hybrid position and speed points are assumed more 
reliable provided that the GNSS measurements are integrated. 

To sum up, the processing carried out by the Kalman hybridization 

25 filter is divided into three stages: 

Propagation of the state vector and of the associated variance- 
covariance matrix 

30 - Readjusting of the state vector and of the variance-covariance matrix 
using the gain K K +i 

X/c+i/k+i = X K + UK + K K+l .{Z K+l - H K + V X K+XIK ) 
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Application of the corrections derived from the Kalman 

hybridization filter to the inertial unit 

COR_FK_p K =-X KIK 

The observation matrix H K+ i is used to observe the differences 
5 between the positions and speeds derived from the virtual platform PFV and 
the resolved GNSS positions and speeds. The evolution matrix F K+ i is 
computed using the data from the virtual platform PFV corrected by the 
Kalman filter and is used to propagate the state and the associated variance- 
covariance matrix. 

10 The problem encountered with the closed loop INS/GNSS hybrid 

positioning systems is the risk of seeing the readjustment operations 
propagate to the inertial unit 1 the position and speed errors committed by 
the GNSS receiver 2 because of defective information reaching it from one or 
more malfunctioning satellites (poor corrections applied by the Kalman filter 

15 to the virtual platform PFV, poor estimation of inertial defects). The integrity 
of the closed loop INS/GNSS hybrid positioning system is then difficult to 
ensure. 

Figure 3 is the diagram of a closed loop INS/GNSS hybrid system 
equipped with a satellite problem-detector operating on position points, in the 
20 form of geographic coordinates, performed by the GNSS receiver 2 with all 
the visible satellites assumed to number N and with all the visible satellites 
minus one of them, the visible satellite that is set aside being any one of 
them. 

The satellite problem-detector 4 comprises a bank of N 
25 predictor/estimator filters 40 u 40 2 ,... f 40j,...,40 N associated with a bank of 
test circuits 41 1, 41 2 ,..., 41i,...,41 N controlling, via an inhibition circuit 5 
inserted at the output of the Kalman hybridization filter 3, the possibility of 
readjustment of the inertial unit 1. 

The predictor/estimator filters 40i, 40 2 ,..., 40i,...,40 N operate in 
30 open loop mode. 

The state vector of the i th predictor/estimator filter 40j is made up 
of the errors relative to the state vector of the Kalman hybridization filter 
induced by the fact that the information given by the i th visible satellite has not 
been taken into account in the GNSS receiver 2, and even more generally 
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relative to measurements made by other navigation equipment such as a 
barometric altimeter or an anemometer. 



Err 1 = 



attitude _ errors _ relative _to_ FK 
speed _ errors relative _to _ FK 
position _ errors _ relative Jto _ FK 
accelero _ bias _ errors _ relative _to_ FK 
gyro _ drift _ errors __ relative Jo FK 
baro _ errors _ relative Jo _ FK 
anemo _ errors _ relative _ to _ FK 



The evolution matrices F K of the various predictor/estimator filters 

40i, 40 2 ,..., 40 f 40 N are identical to that F K of the Kalman hybridization 

filter 3: 



(D 



10 The measurement t of an i ,h predictor/estimator filter 40j is made 

up of the deviation between the position, in the form of geographic 
coordinates (latitude, longitude and altitude), resulting from the positioning 
point P Ntol established by the GNSS receiver 2 taking into account all the N 
visible satellites and the position, in the form of geographic coordinates, 

15 resulting from the positioning point P (AM)/( established by the GNSS receiver 
2 by setting aside the information sent by the i th satellite: 



Z' = 



Ax' 
A/ 
Az' 



- P - P 

— r N-\li r Ntot 



20 The observation matrices H of the different predictor/estimator 

filters 40i, 40 2 ,..., 40 40 N are all identical and correspond to the 

observation equation used to pass from the state vector Err' to the 
measurement vector Z' . 

The gains of the different predictor/estimator filters 40i, 40 2 ,..., 

25 40i,...,40 N are all taken to be equal to that K of the Kalman hybridization filter 
3 such that the readjustment on the measurements z' that they receive takes 
place like the readjustment of the Kalman hybridization filter 3. 



16 



Given these choices, the readjustments of the state vectors Err 1 
of the predictor/estimator filters 40i, 40 2 ,..., 40i,...,40N satisfy the relation: 
ErrLiM = Err LxiK +&k + A Z kJ -H K+l £rr^ UK ) (2) 
To detect the failure of at least one of the N visible satellites by the 
5 GNSS positioning receiver 2, statistical tests are run on the state vectors 
Err 1 available at the output of the different predictor/estimator filters 40i, 

40 2) ..., 40 40 N by means of the bank of test circuits 41 1f 41 2 

41 41 N . These test circuits run statistical tests consisting in admitting a 

satellite failure if, for i ranging from 1 to the number N of visible satellites, one 
10 of the following two inequalities on the position errors of the 
predictor/estimator filters 40i, 40 2 ,..., 40i,...,40 N is satisfied: 

[eit'm , K {err _ lot)' .Err' K+x , K {err _ lat)\ > K _ thresh ' X _ thresh.COV _ Err' K+UK {err _ 
or 

1 5 [Err£ +I/ k {err _ Ion)' .Err' K+UK {err _ lon)\ > K _ thresh' X _ threskCOV _ Err' K+l , K {err _ , 

The variable KJhresh indirectly controls the value of the 
acceptable radial error. It is chosen as a function of the required false alarm 
ratio. For a false alarm probability of 10" 6 , a value of approximately 5.06 
20 (Gaussian distribution) will be taken for the variable KJhresh. 

To carry out these statistical tests, it is essential to be able to 
propagate and readjust the variances associated with the state vectors Err' of 

the different predictor/estimator filters 40i, 40 2 40j 40 N . The 

propagation and readjustment can be carried out as follows: 
25 On initialization, the following is assumed: 

COV_Err' l0 =[6\ 

[o] being the zero matrix. 

On first propagation, by definition: 

30 

COV_Err; i0 =E[Err; i0 .Err; i0 T \ 
which, because of the relation (1), is expressed: 
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COV_Err; /0 = E^Mrr^ +u l i )(F r Err^ l0 +u i i J\ 

u' being a white noise (state noise). 
Hence: 

5 COV_Err; /0 = F v COV _Err^.F, T + Q l 

F being the evolution matrix of the Kalman hybridization filter 3 and Qi the 
covariance matrix of the state noises of the Kalman hybridization filter 3. 
| On first readjustment , by definition: 

COV _Err[ n = E^rr' m .Err[ n 
which, taking into account the relation (2), is expressed: 
15 COV_Err[ n = 4(^./o + M z ' -H^rr^Err^ +K i .{z i -H v Errl l0 )) T \ 
By developing this expression, we find: 

COV _Err; n = E[Err; i0 .Err^ ']+ K v e[z, .Z' T )< +K r H i .E^ /0 .Err^J \h? X? . 
...-4^,/o .ErrU T ]H x T X? -K v H v E[ErrU .Err^] 



20 



Hence: 



COV_Err{ n =(l-X { .H { ).COV _ Errj l0 .(l - K x .H x f + K x .e[z' .Z'")*, 7 
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I being the identity matrix. 
| The first term of the expression of the readjustment of the 

covariance matrix is computed from the observation matrix Hi of the 

predictor/estimator filters 40i, 40 2 ,..., 40 40 N and the gain matrix Ki of the 

30 Kalman hybridization filter 3. The second term is computed using the 
variance/covariance matrices used in the least squares computations 
performed for position, speed and time resolution in the GNSS receiver 2, on 
positioning points with N and (N-1) satellites. In practice, on this resolution, 
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the least squares method estimates the degree of reliance on the points 
resolved by means of the variance/covariance matrices (matrices 
E[P ( n-iyi.P(n-i)fi T ] for the N points with (N-1) satellites and E[P to t.Ptot T ] for the 
point with N satellites). 
Now: 



Because: 



Z' = 



Ay 1 



By developing the first expression, we obtain: 

e[z' .Z iT \= 4-.)// -^-0/. 1+ E h -PL]- AP(N-i)irPl\- A?,* AU» 1 



The first two terms are known. They are directly supplied by the 
least squares computations on resolution of the different position, speed and 
15 time points done by the GNSS receiver 2. 

The terms MVo/^l and £ k^-.)J. reflecting the 
intercorrelation between the positioning point P to t with N satellites and the 
positioning points P (N -iyi with (N-1) satellites, can be evaluated by repeating 
the least squares expression of each point. 
20 In practice, we have: 

P(N-\)li =H (N-l)li- d 

H ( N -i)n Dein 9 tne pseudo-inverse matrix used in the position, speed and time 
resolution done on the positioning point established with N-1 satellites 
(absence of the i th satellite): 

25 Hl N _ l)li =(H( N _ l)li .H {N . l)li yjl{ N . l)li being constructed from the matrix H (N . x)i 

which is the matrix of the directing cosines linking the pseudo-distances d to 
the position resolved by the relation: d = H (N . x)li .P (N . l)n 

d being the vector formed by the pseudo-distances. 
Thus: 



30 
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d.d T \H[ N ^ )lr H l 



tot 



= e[ 

Now: 

H (N-\)ir H Z ={P(N-\)ir H (N-\)ii) ' H (N-\)ir H toX H lr H to) J 

and: 

because the relation: 

(H:,JfJ l (HLJfJ=I 

results in: 

~{hL.hJ 1 (h:,.hJ = i 

1 0 <=> H tot \ H L - H to) f = 1 

~{hi.hJ x ={hi,.h io x] 

Therefore: 

H (N-\)li - H Z = i H (N-l)lt H (N-\)li ) - H (N-l)/i - H io, i H L - H to, ) 

Furthermore, the following equality is obtained: 

15 Hl,- H (N-\)li - H (N-\)li H (N-\)li 

The matrix H {N . l}/i differs from the matrix H m only by the i th line 
which is zero in the case of the matrix H (N . l)n and which includes the 
directing cosines of the line in view of the i th satellite in the case of the matrix 
20 H tot . By calculating the product of matrices H^H^,,, the terms of the i th 
column of the matrix H T M are multiplied by the zero terms of the matrix 
H (N _ )n . Thus, if the terms of the i th column of a matrix multiplied by the matrix 
H (N . )n are already zero (as in the case of the matrix H( N . l)n ), there is no 
change. This explains the above equality. Consequently: 
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H (N-\)li - H Z ~ i H (N-\)li H (AT-l)// ) ^(N-l)/! - H {N-\)li { H L - H tot ) 

={ H L- H io) 



therefore: 
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Finally, we have the relation: 

E[Z' 2 iT \ = 4Vo/< AUn I" E \K, K I 
5 1 

which shows that the matrix Ep'Z"] can be evaluated from matrices 
derived from the computations of the different position, speed and time points 
performed by the GNSS receiver 2. 

The first readjustment and the first propagation do not therefore 
10 pose any problem. The evolution Fi and gain Ki matrices used are those of 
the Kalman hybridization filter 3 whereas the observation matrix H is common 

to all the predictor/estimator filters 40i, 40 2 40 40 N . 

By recurrence, it is possible to show that the same applies for the 
subsequent readjustments and propagations. 
1 5 when at least one of the statistical tests is raised or positive, there 

is a suspicion that one of the visible satellites used by the GNSS receiver 2 to 
determine the position and speed of the bearer is malfunctioning. This 
overrun is used to trigger the inhibition circuit 5 inserted between the output 
of the Kalman hybridization filter 3 and the readjustment input of the inertial 
20 unit 1 , the satellite providing erroneous data will be reintegrated only when all 
the statistical tests are no longer raised, with, where appropriate, an 
additional precautionary delay. 

It will be noted that it is also possible to estimate a protection 
radius on the hybrid position derived from the inertial unit 1 by using the 
25 maximum separation method. 

The satellite problem-detector circuit 4 cannot be used to identify 
the faulty satellite because the erroneous information originating from that 
satellite is taken into account in the point with N visible satellites used as a 
reference. 

30 Bearing in mind that one of the visible satellites used by the GNSS 

receiver 2 is sending suspect information, it is advantageous to be able to 
identify it to have it set aside by the GNSS receiver 2. 

Figure 4 gives an exemplary diagram of a closed loop mode 
INS/GNSS hybrid system equipped with a satellite problem-detector and a 

35 malfunctioning-satellite identifier. 
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As in the case of figure 3, there is an inertial unit INS 1, a GNSS 
receiver 2, a Kalman hybridization filter 3 operating on the residual values of 
the errors between the position, in the form of geographic coordinates, given 
by the inertial unit INS 1 and that, also in the form of geographic coordinates, 
given by the GNSS receiver 2 and providing readjustment information to the 
inertial unit INS 1, and a satellite problem-detector circuit 4 similar to that of 
figure 3 controlling an inhibition circuit 5 inserted between the output of the 
Kalman hybridization filter 3 and a readjustment input of the inertial unit INS 
1. 

In addition to these elements, there appears a malfunctioning- 
satellite identification circuit 6 operating from different position points, in the 
form of geographic coordinates, established by the GNSS receiver 2 with all 
the visible satellites minus one and with all the visible satellites minus two, 
the two visible satellites that are set aside being different each time. The 
malfunctioning-satellite identification circuit 6 operates in parallel with the 
satellite problem-detector circuit 4. It is activated by the circuit 4 if a satellite 
problem is detected. It identifies the malfunctioning satellite for the GNSS 
receiver 2 which then no longer takes it into account in establishing the 
position and speed point that is sent to the Kalman hybridization filter. Once 
the malfunctioning satellite has been set aside, the satellite identification 
circuit 6 reenables the inhibition circuit 5 and the virtual platform PDV of the 
inertial unit INS 1 is once again corrected. 

The malfunctioning-satellite identification circuit 6 is based on tests 
taking as references the different possible position points with N-1 satellites 
that are compared with position points with N-2 satellites derived from these 
points with N-1 . These tests consist in: 

evaluating, for each possible selection of N-1 satellites out of 
the N observable satellites, the position deviations, in the form 
of geographic coordinates, observed between the position point 
established by the GNSS receiver 2 with the set of the N-1 
satellites of the selection and the different possible position 
points with N-2 satellites that the GNSS receiver 2 can establish 
by setting aside an additional satellite from the selection, 
submitting these deviations to a bank of predictor/estimator 
filters to evaluate the error induced jointly by two satellites, 
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comparing the states of this second bank of predictor/estimator 
filters with the variances that are associated with them, 
identifying the family of filters not raising their statistical test and 
deducing from this the malfunctioning satellite, 
5 - indicating to the GNSS receiver the corrupted satellite to 

remove it from the set of visible satellites used to resolve the 
position (and speed) point with N satellites communicated to the 
Kalman filter, 

reenabling the corrections supplied by the Kalman filter to the 
10 inertial unit once the defective satellite has been removed from 

the point of the GNSS receiver and the filter has been 
reconfigured. 

In practice, it is only when the faulty satellite is removed from the 
selection of N-1 satellites and from the resulting selections of N-2 satellites 

15 that the statistical tests on the states of the predictor/estimator filters are not 
triggered (tests not raised). 

As shown in figure 5, the malfunctioning-satellite identification 
circuit 6 comprises a bank of N.(N-1)/2 predictor/estimator filters 61 y 
(l£i<jsN, i and j denote the satellites not observed on resolving the point with 

20 N-2 supplied to the predictor/estimator filter) processing all the deviation 
possibilities between a position point, in the form of geographic coordinates, 
with N-1 visible satellites and a position point, also in the form of geographic 
coordinates, with N-2 visible satellites, the satellite excluded from the 
selection with N-1 satellites also being excluded from the selection with N-2 

25 satellites. A test circuit 62i,j associated with each predictor/estimator filter 61 y 
of the bank tests the states modeled in the predictor/estimator filter against 
their variances. A processing circuit 63 extracts from the tests supplied by the 
test circuits 62j,j the identity of the faulty satellite. 

Each of the predictor/estimator filters 61 y of the filter bank 

30 dedicated to identification of the malfunctioning satellite has the same 
configuration as the predictor/estimator filters 40j of the bank of filters 
dedicated to the detection of malfunctioning of a satellite with the same gain 
K, evolution F and observation H matrices, and receives, as measurement, 
the deviation supplied by a subtractor circuit 60y between the position, in the 

35 form of geographic coordinates (latitude, longitude and altitude), resulting 
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from a positioning point P {N . l)n established by the GNSS satellite positioning 
receiver 2 taking into account the N visible satellites minus one, the i th and 
the position in the form of geographic coordinates resulting from a positioning 
point P (N . 2)IU established by the GNSS satellite positioning receiver 2 by 
5 setting aside the information from the satellite already excluded, the i th and 
one other, the j th . 

The computations of the associated variances necessary to the 
test circuits 62j,j for comparing the states with their variances are exactly the 
same as those described for the test circuits 41 1 associated with the 
10 predictor/estimator filters 40i of the first bank and will not be described again 
here. Only the observation is different since in this case it is a matter of 
difference between points resolved with (N-1) visible satellites and points 
resolved with (N-2) visible satellites. 

The processing circuit 63 compares the tests of the N different 
15 families, in which the i th satellite has been removed for resolution of the 
position point with N-1 and of the position points with N-2 satellites (1£i£N), 
then identifies the defective satellite from the fact that only the 
predictor/estimator filters of one family, that never taking into account the 
defective satellite, has no statistical test raised. In practice, besides the other 
20 families of predictor/estimator filters comparing the position points with N-1 
where the malfunctioning satellite is present with position points with N-2 
satellites have at least one statistical test raised. This processing circuit 63 
makes it possible to avoid the use of the corrupted satellite in resolving the 
GNSS point supplied to the hybrid system. 
25 To help with understanding, the functions performed in a device 

for monitoring the integrity of an INS/GNSS hybrid system have been 
illustrated in the form of separate blocks, but obviously they can be provided 
by one and the same programmed logic computer, for example the flight 
control computer if the bearer of the hybrid positioning system is an aircraft. 
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ABSTRACT 

5 

DEVICE FOR MONITOR I NG THE INTEGR I TY OF I NFORMAT I ON 
DELIVERED BY A HYBR I D I NS/GNSS SYSTEM 

The device is for monitoring the integrity of the position and speed 
10 information supplied by a hybrid system comprising an inertial unit INS 
readjusted using a GNSS satellite positioning receiver by means of a Kalman 
hybridization filter using a readjustment gain K and an evolution matrix F. It 
includes a satellite problem-detector circuit comprising a bank of 
predictor/estimator filters which uses the gain K and the evolution matrix F of 
15 the Kalman hybridization filter, each filter observing the deviation between 
the positioning point obtained from the N visible satellites, in the form of 
geographic coordinates, delivered by the GNSS receiver and one of the 
positioning points P ( N-iyi, also in the form of geographic coordinates, 
delivered by this same GNSS receiver, obtained by using N-1 of the N visible 
20 satellites for resolution, and test circuits comparing the states of the 
predictor/estimator filters with their variances and detecting a satellite failure 
when a test is positive, the deviation found being greater than a detection 
threshold. 
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